Legal

Privacy Policy

Last updated 13 July 2026

DRAFT — pending legal review. This page is a working draft prepared by the Foldout team and has not yet been reviewed by a solicitor. Do not rely on it as final.

Who we are

Foldout is a product operated by Rough (Edinburgh). For questions about this policy or your data, contact privacy@foldout.link.

Two roles

Account data — for the people who run a Foldout account (names, emails, login), we are the data controller. Enquiry data — for the personal data your website visitors submit through enquiry forms (name, contact details, party size, message), we act as a data processor on behalf of the venue, which is the controller. We only process it on the venue’s instructions.

What we collect

Account and billing details you give us; enquiry-form submissions we store and route on a venue’s behalf; and minimal operational telemetry from the embedded widgets (error events and aggregate impression/click counts — no advertising or cross-site tracking pixels).

Where your data lives

Application data (including enquiry submissions) is stored in the EU — our database is hosted by Supabase in the eu-west-1 (Ireland) region. Application hosting and serverless functions are provided by Vercel. Transactional and operational email is sent via AgentMail and may be processed in the United States. See our Data Processing Agreement for the full sub-processor list.

Payments

Where paid checkout is enabled, Lemon Squeezy acts as merchant of record and processes payment details, tax, invoices and subscription administration under its own Privacy Policy. Foldout receives the customer, transaction and subscription records needed to provide the selected plan, but does not store full payment-card details.

Retention

Enquiry submissions are retained per the venue’s configured window (default 24 months) and then permanently deleted. Account data is kept for the life of the account.

Your rights

Under UK/EU GDPR you can request access, correction, erasure, restriction, or portability of your personal data, and object to processing. For enquiry data held on a venue’s behalf, contact that venue (the controller); we will assist them. To exercise rights over account data, email privacy@foldout.link.